https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238813#M70959 <P>I'm trying to plot to two separate values against another value like this</P> <PRE><CODE>timechart avg(x) avg(y) by z </CODE></PRE> <P>And I want to limit the results to the top 5 values. The problem comes in when I use limit to achieve this. It will score z in alphabetical order (each field value z occurs the same amount of times as the rest). How can I get a timechart of these two values, limited to only the z values that have the greatest, x, y values? </P> Wed, 06 Jul 2016 16:27:50 GMT Skamensky 2016-07-06T16:27:50Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238813#M70959 <P>I'm trying to plot to two separate values against another value like this</P> <PRE><CODE>timechart avg(x) avg(y) by z </CODE></PRE> <P>And I want to limit the results to the top 5 values. The problem comes in when I use limit to achieve this. It will score z in alphabetical order (each field value z occurs the same amount of times as the rest). How can I get a timechart of these two values, limited to only the z values that have the greatest, x, y values? </P> Wed, 06 Jul 2016 16:27:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238813#M70959 Skamensky 2016-07-06T16:27:50Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238814#M70960 <P>Please give an example of what your desired result looks like and how that differs from timechart's default behaviour.</P> Wed, 06 Jul 2016 17:29:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238814#M70960 martin_mueller 2016-07-06T17:29:59Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238815#M70961 <P>For instance let say foo and bar have the highest values of x. I want to create a timechart of values x and y by z and I want to display the ones with top value. </P> <P>If I do <CODE>Timechart x y by z limit=x</CODE> it will instead return the z values that are first alphabetically and not ones that have highest x values.</P> Wed, 06 Jul 2016 17:45:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238815#M70961 Skamensky 2016-07-06T17:45:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238816#M70962 <P>Try this</P> <PRE><CODE>... | bin _time as time | stats avg(bytes) as x avg(spent) as y by time z | sort z x y | streamstats window=6 count by z x y | where count&lt;6 | chart values(x) as x values(y) as y over time by z | eval time=strftime(time, "%x %X") </CODE></PRE> Wed, 06 Jul 2016 17:55:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-timechart-for-two-values-but-not-sort-by-the-split/m-p/238816#M70962 sundareshr 2016-07-06T17:55:30Z